Critical Security Update for .NET 9.0: Denial of Service Vulnerability in AspNetCore Runtime
Summary
ALSA-2026:21294: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.16-1.el8_10. Fixed in 9.0.16-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a subset of APIs from the .NET framework along with several new APIs and a Common Language Runtime (CLR) implementation. The AspNetCore Runtime is a key component that allows developers to build web applications and services using .NET. However, a recently discovered vulnerability poses a significant risk to applications relying on this runtime.
Vulnerability Detail
The vulnerability identified as CVE-2026-42899 allows an attacker to exploit an infinite loop within the .NET framework, potentially leading to a denial of service (DoS). This means that an attacker could craft specific inputs that cause the application to hang indefinitely, making it unresponsive to legitimate users. The origin of this vulnerability lies in the handling of certain operations within the runtime, which can be manipulated to create an infinite loop scenario. The ramifications of this vulnerability are severe, as it can lead to application downtime and loss of service availability.
How To Fix
Minimum fixed version
9.0.16-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on your application to reduce the impact of potential denial of service attacks. Additionally, monitor application logs for unusual activity that may indicate an attempted exploit.
Conclusion
The discovery of CVE-2026-42899 highlights the importance of maintaining up-to-date software packages to protect against potential security threats. By applying the necessary updates and monitoring for vulnerabilities, developers can safeguard their applications and ensure continued service availability.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
CVE-2026-42899 is a security vulnerability in the .NET framework that allows an attacker to create an infinite loop, leading to a denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The primary consequence is a denial of service, where the application becomes unresponsive, potentially leading to downtime and loss of service for users.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
Vulert is a tool that monitors open-source vulnerabilities in your software by analyzing manifest files like package-lock.json, providing real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
